---
title: Upload an object
description: Writes the request body as a new version of one object, up to the request limit, and returns the version.
doc_version: 0.1.0-preview
last_updated: 2026-09-14
---

# Upload an object

`PUT /v1/workspaces/{workspaceId}/buckets/{bucketId}/objects/{keyToken}/content`

Writes the request body as a new version of one object, up to the request limit, and returns the version. An existing key gets a new version, and the old one stays recoverable. Send If-None-Match: * to create only. x-amz-meta-<key> headers set the metadata. For a larger file, presign a multipart upload. Role: editor or higher.

## Authentication

Send `Authorization: Bearer <GRAPHON_API_KEY>`. Read the key from the
GRAPHON_API_KEY environment variable. Never print it.

## Path parameters

- `workspaceId` (string) — The workspace id.
- `bucketId` (string) — The bucket id.
- `keyToken` (string) — The object key, base64url-encoded without padding.

## Headers

- `content-length` (string (optional)) — Required. The size of the body in bytes.
- `content-type` (string (optional)) — The object content type. Leave it out to use the type for the key's extension.
- `if-none-match` (string (optional)) — Send * to create only. The PUT fails with 412 when the key exists.
- `if-match` (string (optional)) — Replace only the live version with this etag. Else the PUT fails with 412.
- `x-amz-checksum-sha256` (string (optional)) — The base64 SHA-256 of the body. Graphon Storage rejects other bytes.
- `cache-control` (string (optional)) — Stored with the object and sent back on a read.
- `content-disposition` (string (optional)) — Stored with the object and sent back on a read.
- `content-encoding` (string (optional)) — Stored with the object and sent back on a read.
- `content-language` (string (optional)) — Stored with the object and sent back on a read.

## Example request

```bash
curl --request PUT \
  --url "https://storage.graphon.sh/v1/workspaces/wspq7ws2np5l8z4/buckets/bktA1b2C3d4E5/objects/aW5jaWRlbnRzL2NoZWNrb3V0LXRpbWVvdXQuanNvbg/content" \
  --header "Authorization: Bearer $GRAPHON_API_KEY" \
  --data-binary @./checkout-timeout.json
```

## Sitemap

See the full [sitemap](/sitemap.md) for all pages.